docker/docs
1
0
Fork 0
mirror of https://github.com/docker/docs.git synced 2026-11-05 00:14:17 +03:00
Code Activity

Modify signed.Sign to use a slice instead of varargs

Browse Source 
This is a refactoring with no behavior change, but it will allow adding
more parameters to the function in the future.

Signed-off-by: Miloslav Trmač <mitr@redhat.com>
This commit is contained in:
Miloslav Trmač
2015-11-10 16:40:42 +01:00
committed by Ying Li
parent 6a3c5d7cc7
commit a5da680e90
8 changed files with 30 additions and 40 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
certs/certs_test.go
View File

@@ -291,7 +291,7 @@ func testValidateSuccessfulRootRotation(t *testing.T, keyAlg, rootKeyType string
signedTestRoot, err := testRoot.ToSigned()
require.NoError(t, err)
err = signed.Sign(cs, signedTestRoot, replRootKey, origRootKey)
err = signed.Sign(cs, signedTestRoot, []data.PublicKey{replRootKey, origRootKey})
require.NoError(t, err)
// This call to ValidateRoot will succeed since we are using a valid PEM
@@ -352,7 +352,7 @@ func testValidateRootRotationMissingOrigSig(t *testing.T, keyAlg, rootKeyType st
require.NoError(t, err)
// We only sign with the new key, and not with the original one.
err = signed.Sign(cryptoService, signedTestRoot, replRootKey)
err = signed.Sign(cryptoService, signedTestRoot, []data.PublicKey{replRootKey})
require.NoError(t, err)
// This call to ValidateRoot will succeed since we are using a valid PEM
@@ -416,7 +416,7 @@ func testValidateRootRotationMissingNewSig(t *testing.T, keyAlg, rootKeyType str
require.NoError(t, err)
// We only sign with the old key, and not with the new one
err = signed.Sign(cryptoService, signedTestRoot, origRootKey)
err = signed.Sign(cryptoService, signedTestRoot, []data.PublicKey{origRootKey})
require.NoError(t, err)
// This call to ValidateRoot will succeed since we are using a valid PEM

4
server/handlers/validation_test.go
View File

@@ -387,7 +387,7 @@ func TestValidateRootRotation(t *testing.T) {
r, err = repo.SignRoot(data.DefaultExpires(data.CanonicalRootRole))
require.NoError(t, err)
err = signed.Sign(crypto, r, rootKey, oldRootKey)
err = signed.Sign(crypto, r, []data.PublicKey{rootKey, oldRootKey})
require.NoError(t, err)
rt, err := data.RootFromSigned(r)
@@ -430,7 +430,7 @@ func TestRootRotationNotSignedWithOldKeys(t *testing.T) {
r, err = repo.SignRoot(data.DefaultExpires(data.CanonicalRootRole))
require.NoError(t, err)
err = signed.Sign(crypto, r, rootKey)
err = signed.Sign(crypto, r, []data.PublicKey{rootKey})
require.NoError(t, err)
rt, err := data.RootFromSigned(r)

6
tuf/client/client_test.go
View File

@@ -60,7 +60,7 @@ func TestRotation(t *testing.T) {
// Sign testRoot with both old and new keys
signedRoot, err := testRoot.ToSigned()
err = signed.Sign(signer, signedRoot, rootKey, replacementKey)
err = signed.Sign(signer, signedRoot, []data.PublicKey{rootKey, replacementKey})
require.NoError(t, err, "Failed to sign root")
var origKeySig bool
var replKeySig bool
@@ -122,7 +122,7 @@ func TestRotationNewSigMissing(t *testing.T) {
// Sign testRoot with both old and new keys
signedRoot, err := testRoot.ToSigned()
err = signed.Sign(signer, signedRoot, rootKey)
err = signed.Sign(signer, signedRoot, []data.PublicKey{rootKey})
require.NoError(t, err, "Failed to sign root")
var origKeySig bool
var replKeySig bool
@@ -185,7 +185,7 @@ func TestRotationOldSigMissing(t *testing.T) {
// Sign testRoot with both old and new keys
signedRoot, err := testRoot.ToSigned()
err = signed.Sign(signer, signedRoot, replacementKey)
err = signed.Sign(signer, signedRoot, []data.PublicKey{replacementKey})
require.NoError(t, err, "Failed to sign root")
var origKeySig bool
var replKeySig bool

4
tuf/signed/sign.go
View File

@@ -20,11 +20,11 @@ import (
"github.com/docker/notary/tuf/utils"
)
// Sign takes a data.Signed and a key, calculated and adds the signature
// Sign takes a data.Signed and keys, calculates and adds the signature
// to the data.Signed
// N.B. All public keys for a role should be passed so that this function
// can correctly clean up signatures that are no longer valid.
func Sign(service CryptoService, s *data.Signed, keys ...data.PublicKey) error {
func Sign(service CryptoService, s *data.Signed, keys []data.PublicKey) error {
logrus.Debugf("sign called with %d keys", len(keys))
signatures := make([]data.Signature, 0, len(s.Signatures)+1)
signingKeyIDs := make(map[string]struct{})

32
tuf/signed/sign_test.go
View File

@@ -101,7 +101,7 @@ func TestBasicSign(t *testing.T) {
Signed: &json.RawMessage{},
}
err = Sign(cs, &testData, key)
err = Sign(cs, &testData, []data.PublicKey{key})
require.NoError(t, err)
if len(testData.Signatures) != 1 {
@@ -123,8 +123,8 @@ func TestReSign(t *testing.T) {
Signed: &json.RawMessage{},
}
Sign(cs, &testData, key)
Sign(cs, &testData, key)
Sign(cs, &testData, []data.PublicKey{key})
Sign(cs, &testData, []data.PublicKey{key})
if len(testData.Signatures) != 1 {
t.Fatalf("Incorrect number of signatures: %d", len(testData.Signatures))
@@ -146,7 +146,7 @@ func TestMultiSign(t *testing.T) {
key1, err := cs.Create(data.CanonicalRootRole, "", data.ED25519Key)
require.NoError(t, err)
Sign(cs, &testData, key1)
Sign(cs, &testData, []data.PublicKey{key1})
// reinitializing cs means it won't know about key1. We want
// to attempt to sign passing both key1 and key2, while expecting
@@ -159,8 +159,7 @@ func TestMultiSign(t *testing.T) {
Sign(
cs,
&testData,
key1,
key2,
[]data.PublicKey{key1, key2},
)
if len(testData.Signatures) != 2 {
@@ -186,7 +185,7 @@ func TestSignReturnsNoSigs(t *testing.T) {
testKey, _ := pem.Decode([]byte(testKeyPEM1))
key := data.NewPublicKey(data.RSAKey, testKey.Bytes)
err := Sign(failingCryptoService, &testData, key)
err := Sign(failingCryptoService, &testData, []data.PublicKey{key})
if err == nil {
t.Fatalf("Expected failure due to no signature being returned by the crypto service")
@@ -214,7 +213,7 @@ func TestSignWithX509(t *testing.T) {
testData := data.Signed{
Signed: &json.RawMessage{},
}
err = Sign(mockCryptoService, &testData, tufRSAx509Key)
err = Sign(mockCryptoService, &testData, []data.PublicKey{tufRSAx509Key})
require.NoError(t, err)
require.Len(t, testData.Signatures, 1)
@@ -230,7 +229,7 @@ func TestSignRemovesValidSigByInvalidKey(t *testing.T) {
key1, err := cs.Create(data.CanonicalRootRole, "", data.ED25519Key)
require.NoError(t, err)
Sign(cs, &testData, key1)
Sign(cs, &testData, []data.PublicKey{key1})
require.Len(t, testData.Signatures, 1)
require.Equal(t, key1.ID(), testData.Signatures[0].KeyID)
@@ -239,11 +238,7 @@ func TestSignRemovesValidSigByInvalidKey(t *testing.T) {
// should remove key1 sig even though it's valid. It no longer appears
// in the list of signing keys for the role
Sign(
cs,
&testData,
key2,
)
Sign(cs, &testData, []data.PublicKey{key2})
require.Len(t, testData.Signatures, 1)
require.Equal(t, key2.ID(), testData.Signatures[0].KeyID)
@@ -258,7 +253,7 @@ func TestSignRemovesInvalidSig(t *testing.T) {
key1, err := cs.Create(data.CanonicalRootRole, "", data.ED25519Key)
require.NoError(t, err)
Sign(cs, &testData, key1)
Sign(cs, &testData, []data.PublicKey{key1})
require.Len(t, testData.Signatures, 1)
require.Equal(t, key1.ID(), testData.Signatures[0].KeyID)
@@ -271,12 +266,7 @@ func TestSignRemovesInvalidSig(t *testing.T) {
raw := json.RawMessage([]byte{0xff})
testData.Signed = &raw
// should remove key1 sig because it's out of date
Sign(
cs,
&testData,
key1,
key2,
)
Sign(cs, &testData, []data.PublicKey{key1, key2})
require.Len(t, testData.Signatures, 1)
require.Equal(t, key2.ID(), testData.Signatures[0].KeyID)

14
tuf/signed/verify_test.go
View File

@@ -23,7 +23,7 @@ func TestRoleNoKeys(t *testing.T) {
b, err := json.MarshalCanonical(meta)
require.NoError(t, err)
s := &data.Signed{Signed: (*json.RawMessage)(&b)}
Sign(cs, s, k)
Sign(cs, s, []data.PublicKey{k})
err = Verify(s, roleWithKeys, 1)
require.IsType(t, ErrRoleThreshold{}, err)
}
@@ -40,7 +40,7 @@ func TestNotEnoughSigs(t *testing.T) {
b, err := json.MarshalCanonical(meta)
require.NoError(t, err)
s := &data.Signed{Signed: (*json.RawMessage)(&b)}
Sign(cs, s, k)
Sign(cs, s, []data.PublicKey{k})
err = Verify(s, roleWithKeys, 1)
require.IsType(t, ErrRoleThreshold{}, err)
}
@@ -58,7 +58,7 @@ func TestMoreThanEnoughSigs(t *testing.T) {
b, err := json.MarshalCanonical(meta)
require.NoError(t, err)
s := &data.Signed{Signed: (*json.RawMessage)(&b)}
Sign(cs, s, k1, k2)
Sign(cs, s, []data.PublicKey{k1, k2})
require.Equal(t, 2, len(s.Signatures))
err = Verify(s, roleWithKeys, 1)
require.NoError(t, err)
@@ -75,7 +75,7 @@ func TestValidSigWithIncorrectKeyID(t *testing.T) {
b, err := json.MarshalCanonical(meta)
require.NoError(t, err)
s := &data.Signed{Signed: (*json.RawMessage)(&b)}
Sign(cs, s, k1)
Sign(cs, s, []data.PublicKey{k1})
require.Equal(t, 1, len(s.Signatures))
s.Signatures[0].KeyID = "invalidIDA"
err = Verify(s, roleWithKeys, 1)
@@ -94,7 +94,7 @@ func TestDuplicateSigs(t *testing.T) {
b, err := json.MarshalCanonical(meta)
require.NoError(t, err)
s := &data.Signed{Signed: (*json.RawMessage)(&b)}
Sign(cs, s, k)
Sign(cs, s, []data.PublicKey{k})
s.Signatures = append(s.Signatures, s.Signatures[0])
err = Verify(s, roleWithKeys, 1)
require.IsType(t, ErrRoleThreshold{}, err)
@@ -113,7 +113,7 @@ func TestUnknownKeyBelowThreshold(t *testing.T) {
b, err := json.MarshalCanonical(meta)
require.NoError(t, err)
s := &data.Signed{Signed: (*json.RawMessage)(&b)}
Sign(cs, s, k, unknown)
Sign(cs, s, []data.PublicKey{k, unknown})
s.Signatures = append(s.Signatures)
err = Verify(s, roleWithKeys, 1)
require.IsType(t, ErrRoleThreshold{}, err)
@@ -188,7 +188,7 @@ func Test(t *testing.T) {
b, err := json.MarshalCanonical(meta)
require.NoError(t, err)
s := &data.Signed{Signed: (*json.RawMessage)(&b)}
Sign(cryptoService, s, k)
Sign(cryptoService, s, []data.PublicKey{k})
run.s = s
}
if run.mut != nil {

2
tuf/testutils/swizzler.go
View File

@@ -72,7 +72,7 @@ func serializeMetadata(cs signed.CryptoService, s *data.Signed, role string,
return nil, ErrNoKeyForRole{role}
}
if err := signed.Sign(cs, s, pubKeys...); err != nil {
if err := signed.Sign(cs, s, pubKeys); err != nil {
if _, ok := err.(signed.ErrNoKeys); ok {
return nil, ErrNoKeyForRole{Role: role}
}

2
tuf/tuf.go
View File

@@ -919,7 +919,7 @@ func (tr *Repo) SignTimestamp(expires time.Time) (*data.Signed, error) {
}
func (tr Repo) sign(signedData *data.Signed, role data.BaseRole) (*data.Signed, error) {
if err := signed.Sign(tr.cryptoService, signedData, role.ListKeys()...); err != nil {
if err := signed.Sign(tr.cryptoService, signedData, role.ListKeys()); err != nil {
return nil, err
}
return signedData, nil